# Non-secret inventory template — copy to ~/.config/warden/inventory.yaml
# and adjust for your environment. Do not commit real operator paths or keys.
#
# See wiki/ActorInventoryPatterns.md and wiki/OpsWardenConfig.md

actors:
  agt-state-hub-bridge:
    type: agt
    principals:
      - agt-task-bridge
    ttl_hours: 24
    description: "ops-bridge tunnel agent for state-hub"
    zone_subject:
      applicability: applicable
      workload_id: ops-bridge-tunnel

  agt-codex-interhub-bootstrap:
    type: agt
    principals:
      - agt-interhub-bootstrap
    ttl_hours: 2
    description: "Short-lived agent access for attended Inter-Hub bootstrap"
    zone_subject:
      applicability: applicable
      workload_id: codex-interhub-bootstrap

  # CUST-WP-0073-T02 / WARDEN-WP-0045: supervised interactive agent account
  # (Codex, Claude Code, Grok Build) on host account custodian-agt @ Railiance01.
  # Issued only by the supervisor from the operator account; the agent distro
  # (custodian-agents) holds no warden config, CA key or Vault token.
  # No source-address: workstation egress IP is not stable (see wiki).
  agt-custodian:
    type: agt
    principals:
      - agt-custodian
    ttl_hours: 12
    max_ttl_hours: 12
    extensions:
      - permit-pty
    description: "Supervised interactive custodian agent (custodian-agt on Railiance01)"
    zone_subject:
      applicability: applicable
      workload_id: custodian-agents

  adm-example:
    type: adm
    principals:
      - adm-full
    ttl_hours: 48
    description: "Example human operator — replace with per-person adm-* actors"
    zone_subject:
      applicability: not-applicable
      reason: human operator retains native actor identity

  atm-backup-daily:
    type: atm
    principals:
      - atm-backup-daily
    ttl_hours: 8
    description: "Example nightly automation actor"
    zone_subject:
      applicability: applicable
      workload_id: backup-daily

hosts:
  example-host:
    allowed_principals:
      agt:
        - agt-task-bridge
      atm:
        - atm-backup-daily